test: enforce gate 2 coverage and vertical contracts

.github/workflows/conditional-tests.yml

@@ -3,6 +3,10 @@ name: Conditional tests
 on:
   workflow_dispatch:
     inputs:
+      candidate_sha:
+        description: Candidate commit SHA expected in software conditional evidence
+        type: string
+        default: ""
       run_model:
         description: Run pinned tiny-model download and evaluation gates
         type: boolean
@@ -31,6 +35,14 @@ on:
         description: Run the least-privileged SSH provider gate
         type: boolean
         default: false
+      stale_evidence_reason:
+        description: Maintainer reason for accepting older software conditional evidence
+        type: string
+        default: ""
+      stale_evidence_issue:
+        description: OBLITERATUS issue URL approving older software conditional evidence
+        type: string
+        default: ""
   schedule:
     - cron: "17 6 * * 0"
   release:
@@ -44,6 +56,9 @@ concurrency:
   cancel-in-progress: false
 
 env:
+  CONDITIONAL_CANDIDATE_SHA: ${{ github.event.inputs.candidate_sha || github.sha }}
+  CONDITIONAL_STALE_EVIDENCE_ISSUE: ${{ github.event.inputs.stale_evidence_issue || '' }}
+  CONDITIONAL_STALE_EVIDENCE_REASON: ${{ github.event.inputs.stale_evidence_reason || '' }}
   PIP_DISABLE_PIP_VERSION_CHECK: "1"
   PIP_NO_INPUT: "1"
   UV_VERSION: "0.12.4"
@@ -95,6 +110,15 @@ jobs:
         run: >-
           "$CONDITIONAL_ENV/bin/python" scripts/run_conditional_gate.py
           external-evaluation
+      - name: Validate software evidence freshness
+        run: >-
+          "$CONDITIONAL_ENV/bin/python" scripts/check_conditional_policy.py
+          --candidate-sha "$CONDITIONAL_CANDIDATE_SHA"
+          --evidence-dir conditional-evidence
+          --require-gate model-download-runtime
+          --require-gate external-evaluation
+          --stale-evidence-reason "$CONDITIONAL_STALE_EVIDENCE_REASON"
+          --stale-evidence-issue "$CONDITIONAL_STALE_EVIDENCE_ISSUE"
       - name: Upload model-runtime evidence
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -128,6 +152,14 @@ jobs:
         run: >-
           "$CONDITIONAL_ENV/bin/python" scripts/run_conditional_gate.py
           network-services
+      - name: Validate software evidence freshness
+        run: >-
+          "$CONDITIONAL_ENV/bin/python" scripts/check_conditional_policy.py
+          --candidate-sha "$CONDITIONAL_CANDIDATE_SHA"
+          --evidence-dir conditional-evidence
+          --require-gate network-services
+          --stale-evidence-reason "$CONDITIONAL_STALE_EVIDENCE_REASON"
+          --stale-evidence-issue "$CONDITIONAL_STALE_EVIDENCE_ISSUE"
       - name: Upload network evidence
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -161,6 +193,14 @@ jobs:
         run: >-
           "$CONDITIONAL_ENV/bin/python" scripts/run_conditional_gate.py
           operator-ui
+      - name: Validate software evidence freshness
+        run: >-
+          "$CONDITIONAL_ENV/bin/python" scripts/check_conditional_policy.py
+          --candidate-sha "$CONDITIONAL_CANDIDATE_SHA"
+          --evidence-dir conditional-evidence
+          --require-gate operator-ui
+          --stale-evidence-reason "$CONDITIONAL_STALE_EVIDENCE_REASON"
+          --stale-evidence-issue "$CONDITIONAL_STALE_EVIDENCE_ISSUE"
       - name: Upload UI evidence
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1